Two factor validation and security response of SSL certificates

Abstract

Methods and apparatuses for authenticating a secure sockets layer certificate (SSL) certificate are described herein. The methods include receiving the SSL certificate associated with a website, identifying a chain of trust associated with the SSL certificate, transmitting, to a security manager, a validation request based on the SSL certificate and a certificate in the chain of trust, receiving a validation response from the security manager, and presenting an indication of trustworthiness, to a user, based on the validation response. The apparatuses are provided to implement the methods.

What is claimed is: 
     
       1. A method, implemented by a computing system programmed to perform the following, the method comprising:
 receiving, by a credential manager at a client device, a secure sockets layer (SSL) certificate associated with a website; 
 identifying, at the client device, a chain of trust associated with the SSL certificate; 
 transmitting, to a security manager of a trusted certificate authority, a validation request based on the SSL certificate and a certificate in the chain of trust; 
 receiving a validation response from the security manager of the trusted certificate authority; 
 notifying the security manager that the SSL certificate is malicious when a root certificate of a true root certificate authority does not match a root certificate in the chain of trust associated with the SSL certificate; 
 transmitting identifying information to the security manager when the true root certificate does not match the root certificate of the chain of trust, wherein the identifying information comprises: an internet protocol (IP) address of the website, an IP address of the credential manager, a name of the true root certificate authority, and a name of the root certificate authority associated with the SSL certificate; and 
 presenting an indication of trustworthiness of the SSL certificate based on the validation response. 
 
     
     
       2. The method of  claim 1 , further comprising generating the validation request using a signing certificate that is common to the credential manager and the security manager. 
     
     
       3. The method of  claim 1 , wherein the validation response further comprises an indication that a root certificate authority associated with the SSL certificate is valid. 
     
     
       4. The method of  claim 1 , further comprising notifying the true root certificate authority and the root certificate authority associated with the SSL certificate when the true root certificate does not match the root certificate of the chain of trust. 
     
     
       5. The method of  claim 1 , further comprising preventing a web browser application from accessing the website when the true root certificate does not match the root certificate of the chain of trust. 
     
     
       6. A computing system comprising:
 a memory; and 
 a processor coupled with the memory, the processor to execute a credential manager, wherein the credential manager is to:
 receive a secure sockets layer (SSL) certificate associated with a website; 
 identify a chain of trust associated with the SSL certificate; 
 transmit, to a security manager of a trusted certificate authority, a validation request based on the SSL certificate and a certificate in the chain of trust; 
 receive a validation response from the security manager of the trusted certificate authority, wherein the validation response further comprises an indication that a root certificate authority associated with the SSL certificate is valid; 
 present an indication of trustworthiness of the SSL certificate based on the validation response; 
 notify the security manager that the SSL certificate is malicious when a true root certificate does not match the certificate of the chain of trust associated with the SSL certificate; and 
 transmit identifying information to the security manager when the true root certificate does not match the certificate of the chain of trust, the identifying information comprising an internet protocol (IP) address of the website, an IP address of the credential manager, a name of a true root certificate authority, and a name of the root certificate authority associated with the SSL certificate. 
 
 
     
     
       7. The computing system of  claim 6 , wherein the credential manager is further to generate the validation request using a signing certificate that is common to the credential manager and the security manager. 
     
     
       8. The computing system of  claim 6 , wherein the credential manager is further to notify a true root certificate authority and the root certificate authority associated with the SSL certificate when the true root certificate does not match the root certificate of the chain of trust. 
     
     
       9. The computing system of  claim 6 , wherein the credential manager is further to prevent a web browser application from accessing the website when the true root certificate does not match the root certificate of the chain of trust. 
     
     
       10. A non-transitory computer readable storage medium including instructions that, when executed by a processor, cause the processor to perform operations comprising:
 receiving, by a credential manager at a client device, a secure sockets layer (SSL) certificate associated with a website; 
 identifying, at the client device, a chain of trust associated with the SSL certificate; 
 transmitting, to a security manager of a certificate authority, a validation request based on the SSL certificate and a certificate in the chain of trust; 
 receiving a validation response from the security manager of the certificate authority; 
 notifying the security manager that the SSL certificate is malicious when a true root certificate does not match a root certificate of the chain of trust; 
 transmitting identifying information to the security manager when the true root certificate does not match the root certificate of the chain of trust, the identifying information comprising an internet protocol (IP) address of the website, an IP address of the credential manager, a name of the root certificate authority, and a name of a valid root certificate authority; 
 presenting an indication of trustworthiness based on the validation response. 
 
     
     
       11. The non-transitory computer readable storage medium of  claim 10 , wherein the operations further comprises generating the validation request using a signing certificate that is common to the credential manager and the security manager. 
     
     
       12. The non-transitory computer readable storage medium of  claim 10 , wherein the validation response further comprises an indication that a root certificate authority associated with the SSL certificate is valid. 
     
     
       13. The non-transitory computer readable storage medium of  claim 10 , wherein the operations further comprises notifying the security manager when the true root certificate does not match the root certificate of the chain of trust.